Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im FortniteClient-Win64-Shipping_EAC_EOS
- '<SYSTEM32>\taskkill.exe' /f /im EasyAntiCheat_EOS.exe
- '<SYSTEM32>\taskkill.exe' /f /im EpicGamesLauncher.exe
- '<SYSTEM32>\taskkill.exe' /f /im FortniteClient-Win64-Shipping.exe
- '<SYSTEM32>\taskkill.exe' /f /im EADesktop.exe
- '<SYSTEM32>\taskkill.exe' /f /im OriginClientService.exe
- '<SYSTEM32>\taskkill.exe' /f /im r5apex.exe
- '<SYSTEM32>\taskkill.exe' /f /im Origin.exe
- '<SYSTEM32>\taskkill.exe' /f /im EABackgroundService.exe
- '<SYSTEM32>\taskkill.exe' /f /im VALORANT.exe
- '<SYSTEM32>\taskkill.exe' /f /im VALORANT-Win64-Shipping.exe
- '<SYSTEM32>\taskkill.exe' /f /im vgtray.exe
- '<SYSTEM32>\taskkill.exe' /f /im vgc.exe
- '<SYSTEM32>\net.exe' stop vgk
- '<SYSTEM32>\taskkill.exe' /f /im vgk.sys
- '<SYSTEM32>\net.exe' stop vgc
- '<SYSTEM32>\taskkill.exe' /f /im RiotClientUxRender.exe
- '<SYSTEM32>\net.exe' stop BEService
- '<SYSTEM32>\taskkill.exe' /f /im RiotClientServices.exe
- '<SYSTEM32>\taskkill.exe' /f /im league of legends.exe
- '<SYSTEM32>\taskkill.exe' /f /im steam.exe
- '<SYSTEM32>\taskkill.exe' /f /im RiotClientUx.exe
- '<SYSTEM32>\taskkill.exe' /f /im SteamService.exe
- '<SYSTEM32>\taskkill.exe' /f /im steamwebhelper.exe
- '<SYSTEM32>\taskkill.exe' /f /im ESEA.exe
- '<SYSTEM32>\taskkill.exe' /f /im BEService.exe
- '<SYSTEM32>\taskkill.exe' /f /im FACEITService.exe
- '<SYSTEM32>\taskkill.exe' /f /im BEService_x64.exe
- '<SYSTEM32>\taskkill.exe' /f /im FACEITClient.exe
- '<SYSTEM32>\taskkill.exe' /f /im ESEAService.exe
- '<SYSTEM32>\taskkill.exe' /f /im Agent.exe
- '<SYSTEM32>\taskkill.exe' /f /im Battle.net.exe
- '<SYSTEM32>\taskkill.exe' /f /im Garena.exe
- '<SYSTEM32>\taskkill.exe' /f /im GenshinImpact.exe
- '<SYSTEM32>\taskkill.exe' /f /im mhyprot2.sys
- '<SYSTEM32>\taskkill.exe' /f /im GarenaService.exe
- '<SYSTEM32>\taskkill.exe' /f /im PnkBstrA.exe
- '<SYSTEM32>\taskkill.exe' /f /im PnkBstrB.exe
- '<SYSTEM32>\taskkill.exe' /f /im NGS.exe
- '<SYSTEM32>\taskkill.exe' /f /im NGSService.exe
- '<SYSTEM32>\taskkill.exe' /f /im xhunter1.sys
- '<SYSTEM32>\taskkill.exe' /f /im xhunter64.sys
- '<SYSTEM32>\taskkill.exe' /f /im npggnt.sys
- '<SYSTEM32>\taskkill.exe' /f /im npgguard.sys
- '<SYSTEM32>\taskkill.exe' /f /im UbisoftConnect.exe
- '<SYSTEM32>\taskkill.exe' /f /im UbisoftGameLauncher.exe
- '<SYSTEM32>\taskkill.exe' /f /im UplayWebCore.exe
- '<SYSTEM32>\taskkill.exe' /f /im ModernWarfare.exe
- '<SYSTEM32>\taskkill.exe' /f /im UbisoftGameLauncher64.exe
- '<SYSTEM32>\taskkill.exe' /f /im Ubisoft Game Launcher
- '<SYSTEM32>\taskkill.exe' /f /im BlackOpsColdWare.exe
- '<SYSTEM32>\taskkill.exe' /f /im Warzone.exe
- '<SYSTEM32>\taskkill.exe' /f /im COD.exe
- '<SYSTEM32>\taskkill.exe' /f /im RainbowSix_Vulkan.exe
Launches a large number of processes
Modifies file system
Creates the following files
- %TEMP%\screenshot.bmp
Deletes the following files
- %WINDIR%\temp\dmi3ddf.tmp
- %WINDIR%\temp\fwtsqmfile00.sqm
- %WINDIR%\temp\fwtsqmfile01.sqm
- %WINDIR%\temp\ts_20dd.tmp
- %WINDIR%\temp\ts_235f.tmp
- %WINDIR%\temp\ts_23ec.tmp
- %WINDIR%\temp\ts_2862.tmp
- %WINDIR%\temp\ts_2b9f.tmp
- %WINDIR%\temp\ts_2da4.tmp
- %WINDIR%\temp\ts_2eed.tmp
- %WINDIR%\temp\ts_3595.tmp
- %WINDIR%\temp\ts_3622.tmp
- %TEMP%\screenshot.bmp
Network activity
Connects to
- 'ip##pi.com':80
- 'localhost':49180
- 'localhost':49182
- 'di##ord.com':443
- 'localhost':49185
- 'localhost':49187
- 'localhost':49190
- 'localhost':49192
- 'localhost':49195
- 'localhost':49197
TCP
HTTP GET requests
- http://ip##pi.com/json
Other
- 'localhost':49180
- 'localhost':49182
- 'localhost':49183
- 'di##ord.com':443
- 'localhost':49185
- 'localhost':49187
- 'localhost':49188
- 'localhost':49190
- 'localhost':49192
- 'localhost':49193
- 'localhost':49195
- 'localhost':49197
- 'localhost':49198
UDP
- DNS ASK ip##pi.com
- DNS ASK di##ord.com
Miscellaneous
Searches for the following windows
- ClassName: '9Fjh_bdq{`' WindowName: ''
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im FortniteClient-Win64-Shipping_EAC_EOS
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im EasyAntiCheat_EOS.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im EpicGamesLauncher.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im FortniteClient-Win64-Shipping.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im r5apex.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im EADesktop.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im EABackgroundService.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im Origin.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im OriginClientService.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im VALORANT.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im VALORANT-Win64-Shipping.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im vgc.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im vgtray.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im vgk.sys
- '<SYSTEM32>\cmd.exe' /C net stop vgk
- '<SYSTEM32>\cmd.exe' /C net stop vgc
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im RiotClientServices.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im RiotClientUx.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im RiotClientUxRender.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im league of legends.exe
- '<SYSTEM32>\net1.exe' stop vgk
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im steam.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im SteamService.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im steamwebhelper.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im BEService.exe
- '<SYSTEM32>\net1.exe' stop vgc
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im BEService_x64.exe
- '<SYSTEM32>\cmd.exe' /C net stop BEService
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im FACEITClient.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im FACEITService.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im ESEA.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im ESEAService.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im Battle.net.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im Agent.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im GenshinImpact.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im mhyprot2.sys
- '<SYSTEM32>\net1.exe' stop BEService
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im Garena.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im GarenaService.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im PnkBstrA.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im PnkBstrB.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im NGS.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im NGSService.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im xhunter1.sys
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im xhunter64.sys
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im npggnt.sys
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im npgguard.sys
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im UbisoftConnect.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im UbisoftGameLauncher.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im UbisoftGameLauncher64.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im UplayWebCore.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im Ubisoft Game Launcher
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im ModernWarfare.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im BlackOpsColdWare.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im Warzone.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im COD.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im CODWarzone.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im RainbowSix.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im RainbowSix_BE.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im RainbowSix_Vulkan.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im TslGame.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im ExecPubg.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im TslGame_BE.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im EscapeFromTarkov.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im BsgLauncher.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im Battleye.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im DayZ_BE.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im DayZ_x64.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im RustClient.exe
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im FortniteClient-Win64-Shipping_EAC_EOS' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im EasyAntiCheat_EOS.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im EpicGamesLauncher.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im FortniteClient-Win64-Shipping.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im r5apex.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im EADesktop.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im EABackgroundService.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im Origin.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im OriginClientService.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im VALORANT.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im VALORANT-Win64-Shipping.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im vgc.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im vgtray.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im vgk.sys' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C net stop vgk' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C net stop vgc' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im RiotClientServices.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im RiotClientUx.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im RiotClientUxRender.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im league of legends.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im steam.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im SteamService.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im steamwebhelper.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im BEService.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im BEService_x64.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C net stop BEService' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im FACEITClient.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im FACEITService.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im ESEA.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im ESEAService.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im Battle.net.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im Agent.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im GenshinImpact.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im mhyprot2.sys' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im Garena.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im GarenaService.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im PnkBstrA.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im PnkBstrB.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im NGS.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im NGSService.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im xhunter1.sys' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im xhunter64.sys' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im npggnt.sys' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im npgguard.sys' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im UbisoftConnect.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im UbisoftGameLauncher.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im UbisoftGameLauncher64.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im UplayWebCore.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im Ubisoft Game Launcher' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im ModernWarfare.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im BlackOpsColdWare.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im Warzone.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im COD.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im CODWarzone.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im RainbowSix.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im RainbowSix_BE.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im RainbowSix_Vulkan.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im TslGame.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im ExecPubg.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im TslGame_BE.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im EscapeFromTarkov.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im BsgLauncher.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im Battleye.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im DayZ_BE.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im DayZ_x64.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /f /im RustClient.exe' (with hidden window)
